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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 
established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment 
to the Inspector General Act of 1978. This is one of a series of audit, inspection, and 
special reports prepared as part of our oversight responsibilities to promote economy, 
efficiency, and effectiveness within the department. 

This report addresses the strengths and weaknesses of the department's acquisition 
management process. It is based on interviews with employees and officials of relevant 
agencies and institutions, direct observations, and a review of applicable documents. 

The recommendations herein have been developed to the best knowledge available to our 
office, and have been discussed in draft with those responsible for implementation. We 
trust this report will result in more effective, efficient, and economical operations. We 
express our appreciation to all of those who contributed to the preparation of this report. 




Anne L. Richards 

Assistant Inspector General for Audits 



Table of Contents/Abbreviations 



Executive Summary 1 

Background 2 

Results of Audit 4 

Guidance 5 

Available Tools 11 

Component Policies and Procedures 14 

Recommendations 16 

Management Comments and OIG Analysis 16 



Appendixes 

Appendix A: 
Appendix B: 
Appendix C: 
Appendix D: 
Appendix E: 
Appendix F: 
Appendix G: 

Figures 

Figure 1: 
Figure 2: 

Tables 

Table 1: 
Table 2: 
Table 3: 
Table 4: 

Abbreviations 



APMD Acquisition Program Management Division 

CBP Customs and Border Protection 

COTS commercial off-the-shelf 

CPO Chief Procurement Officer 

DHS Department of Homeland Security 



Purpose, Scope, and Methodology 20 

Management Comments to the Draft Report 21 

Acquisition Programs Reviewed 28 

Acquisition Program Comparison 29 

Acquisition Lifecycle Framework (Directive 102-01) 30 

Major Contributors to this Report 31 

Report Distribution 32 



Component Budget Authority for Fiscal Years 2006-2010 2 

nPRS Policy Timeline 9 



Acquisition Program Levels 3 

Acquisition Program Reporting System Inconsistencies 10 

Acquisition Program Inconsistencies 10 

Component Policies and Procedures 15 



Directive 102-01 


Acquisition Management Directive 102-01, Revision 




Number 01 


FEMA 


Federal Emer^encv Management A^encv 


FLETC 


Federal Law Enforcement Training Center 


FY 


fiscal year 


Guidebook 


Acquisition Instruction/Guidebook 102-01-001, Interim Version 




1.9 (Nov. 7, 2008) 


ICE 


Immigration and Customs Enforcement 


IT 


information technology 


nPRS 


next Generation Periodic Reporting System 


OIG 


Office of Inspector General 


SSPO 


Strategic Sourcing Program Office 


TSA 


Transportation Security Administration 


USCIS 


U.S. Citizenship and Immigration Services 


USM 


Under Secretary for Management 



OIG 

Department of Homeland Security 
Office of Inspector General 

Executive Summary 

Acquisitions consume a significant part of the Department of 
Homeland Security's annual budget and are fundamental to the 
department's ability to accomplish its mission. The department's 
revised enacted budget authority for fiscal year 2010 is 
approximately $55.3 billion, and between October 2009 and 
August 2010, it obligated about $9.2 billion for procurement costs. 
We performed this audit to determine whether the department 
established adequate management oversight and controls over 
component acquisition programs. 

The department has generally made progress in its acquisition 
oversight processes and controls through implementation of a 
revised acquisition management directive. However, the department 
needs to further refine its guidance by providing additional detailed 
guidance and improving controls in some areas. The department has 
not fully defined, for its components, what constitutes an acquisition 
program, or developed consistent guidance for reporting acquisition 
programs in its standard reporting system. In addition, the 
department did not ensure that components were using all 
acquisition tools available and that all components had adequate 
policies and procedures in place to manage acquisition programs. 

As a result, components created program management offices to 
manage simple procurements, incurring unnecessary administrative 
program costs without adding value to the programs. Additionally, 
without adequate controls in place, the department did not have 
complete visibility of all programs within its acquisition portfolio. 

We made four recommendations to the Chief Procurement Officer 
to strengthen the department's management oversight and controls 
over component acquisition programs. The Chief Procurement 
Officer agreed with our recommendations and initiated corrective 
actions. 
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Background 



The Department of Homeland Security (DHS) continues to face 
challenges associated with implementing a fully integrated 
acquisition function. A successful acquisition process requires an 
effective acquisition management infrastructure. Acquisition 
management is a complex process that goes beyond simply 
awarding a contract. It begins with the identification of a mission 
need; continues with the development of a strategy to fulfill that 
need while balancing cost, schedule, and performance; and 
concludes with contract closeout after satisfactorily meeting the 
terms. Acquisition management includes managing operational 
and life cycle requirements — from formulating concepts of 
operations, developing sound business strategies, and exercising 
prudent financial management to assessing tradeoffs and managing 
program risks. 

The department's revised enacted budget authority for fiscal year 
(FY) 2010 is approximately $55.3 billion. Between October 2009 
and August 2010, the department obligated about $9.2 billion in 
procurement cost, of its total $55.3 billion. DHS's total budget 
authority increased from about $40.3 billion in 2006 to about $55.3 
billion in 2010, an increase of about 37%, excluding any 
supplemental funding and rescissions of prior-year carryover 
funds. Figure 1 illustrates the components' budget authority for 
the past 5 years. 



Figure 1. Component Budget Authority for Fiscal Years 2006-2010 
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Recognizing the continued increase in the quantity and complexity 
of acquisitions supporting its missions, the department prescribed 
additional guidance for acquisition management and oversight 
beginning in November 2008. The Chief Acquisition Officer 
classified acquisitions into three levels to define the extent and 
scope of required project and program management and the 
specific official 1 who serves as the Acquisition Decision Authority. 
Table 1 lists these levels. 

Table 1: Acquisition Program Levels 

Lifecycle Cost Acquisition Decision Authority* 

Level 1 Greater than or equal to $1 billion Deputy Secretary 

Level 2 $300 million to $1 billion Chief Acquisition Officer 

Level 3 Less than $300 million Component Head 

*Refer to footnote below. 

The following entities within DHS have a role in managing and 
overseeing acquisition programs: 

• Chief Acquisition Officer - Responsible for managing, 
administering, and overseeing the department's acquisition 
policies and procedures. The Under Secretary for 
Management (USM) is currently the Chief Acquisition 
Officer who designates Component Acquisition Executives. 

• Component Heads - Oversee acquisitions within their 
component in accordance with the department's acquisition 
policies and procedures, and ensure sound management, 
review, support, approval, and oversight of all types of 
acquisitions within the component. 

• Acquisition Decision Authority - Department and 
component officials responsible for ensuring compliance 
with Acquisition Management Directive 102-01, Revision 
Number 01 (Directive 102-01) by reviewing and approving 
the movement of acquisitions through the phases of the 
acquisition life cycle upon satisfaction of applicable criteria 
at an Acquisition Review Board. 

• Acquisition Review Board - Cross-component board within 
the department that determines whether a proposed 
acquisition has met the requirements of key phases in the 
Acquisition Lifecycle Framework and is able to proceed to 
the next phase. The Acquisition Review Board is composed 



The Acquisition Decision Authority may designate his or her responsibilities to other officials. 
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of officials that the Acquisition Decision Authority 
determines to be knowledgeable of the subject matter. 

• Component Acquisition Executives - Senior acquisition 
officials within a component responsible for implementing, 
managing, and overseeing their component's acquisition 
processes. Component Acquisition Executives coordinate 
contracting and procurement processes with the 
component's Head of Contracting Activity. 

• Director, Acquisition Program Management Division 
(APMD) - Responsible for developing and maintaining 
acquisition policy, procedures, and guidance, as well as 
assisting the Chief Acquisition Officer in the management 
of the department's acquisition portfolio. 

On May 26, 2010, the USM issued the department's latest Major 
Acquisition Oversight List. The list identified 86 major acquisition 
programs, projects, and services requiring direct departmental 
oversight. The department oversees acquisition programs at or 
above $300 million 2 in life cycle cost. Components are responsible 
for the oversight and controls for acquisition programs below the 
$300 million threshold. 

Results of Audit 

DHS generally had management oversight and controls in place over components' 
acquisition programs. In January 2010, the department issued Revision Number 
01 to its interim Directive 102-01 directive, which prescribed guidance over the 
Acquisition Review Process, Acquisition Lifecycle Framework, and Acquisition 
Review Board. It also issued a supplemental Acquisition Instruction/Guidebook 
102-01-001, Version 1.9 (November 7, 2008) (Guidebook) to the interim directive 
that provided detailed instructions on implementing and managing acquisition 
management. The Directive and Guidebook addressed many of the oversight and 
control problems previously identified regarding acquisition management. 
Directive 102-01 and the Guidebook were positive steps, but the department can 
do more. 

The department needs to further refine policies in some areas and strengthen 
oversight in others. Some components were creating program management 
offices to manage simple procurements, not properly reporting programs into the 
standard system, or not applying strategic sourcing strategies to support program 
development. Additionally, not all components developed component-level 



2 The Acquisition Review Board can elevate acquisition program levels based on five exceptions listed in 
Directive 102-01. 
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acquisition policies and procedures to manage their programs. As a result, some 
components unnecessarily created acquisition programs, which potentially 
increased administrative costs without adding value to the programs, and the 
department does not always know what is in its acquisition portfolio. 

Guidance 

The department did not fully define, for its components, what should 
constitute an acquisition program or develop consistent guidance for 
reporting requirements into its standard reporting system. The department 
did not provide consistent acquisition program reporting guidance for the 
use of the next Generation Periodic Reporting System (nPRS). As a 
result, component personnel, motivated to implement and follow 
department guidance, unnecessarily created acquisition programs that 
potentially incurred additional program management costs and distorted 
the position of the department's acquisition portfolio. Components further 
distorted the acquisition portfolio position by inconsistently reporting 
programs into nPRS. 

Directive 102-01 

The department has not fully defined when a component should 
manage an acquisition under the requirements of the Acquisition 
Lifecycle Framework or manage it as a simple procurement. We 
found that many components were committed to following the 
department's guidance but needed more structure for determining 
when to establish a program to acquire a product or service. We 
requested a list of all programs from each component and received 
numerous questions and conflicting responses. For example: 

• Immigration and Customs Enforcement (ICE) personnel 
stated that they were having problems identifying level 3 
acquisition programs because they believed that Directive 
102-01 did not adequately define an acquisition program. 
In May 2010, ICE personnel provided a preliminary list of 
their acquisition programs, but as of October 1, 2010, they 
had not provided a final list. 

• Science and Technology personnel asked the audit team if 
they should include the funding and conducting of research 
and development programs or projects as acquisition 
programs. They specifically questioned whether they 
should manage the First Responder websites they operate 
and maintain as acquisition programs. 
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• Domestic Nuclear Detection Office personnel asked if there 
were details that explained which acquisitions were or were 
not programs. They stated that the definition for 
acquisition programs is so broad that they were unsure 
whether the small contracts for services were level 3 
acquisition programs. 

• Transportation Security Administration (TSA) personnel 
stated that they classified all acquisitions that appeared to 
be programs as acquisition programs because the definition 
was unclear. 

• Federal Emergency Management Agency (FEMA) 
personnel were uncertain whether to classify large service 
contracts as acquisition programs. Initially, when we 
requested a list of FEMA' s programs, FEMA personnel 
stated that they could not provide a complete list of 
programs for 6 to 12 months. Senior personnel explained 
that FEMA was in the process of reorganizing its acquisition 
management function. After meeting with senior 
management personnel, toward the end of audit fieldwork, 
we received a draft list of programs, but as of October 1, 
2010, FEMA personnel had not provided a final list. 

Directive 102-01 establishes the overall policy and structure for 
acquisition management within the department, but does not 
provide a decision-making tool to determine if an acquisition 
warrants the higher level of internal controls required by the 
Acquisition Lifecycle Framework. According to the glossary of 
the Guidebook, an acquisition program is the totality of activities 
directed to accomplish a program to acquire or support/sustain 
capabilities, funded through one or more investments. In contrast, 
the Guidebook defines an acquisition as the conceptualization, 
initiation, design, development, test, contracting, production, 
deployment, logistics support, modification, and disposal of 
systems, supplies, or services (including construction) to satisfy 
DHS needs. To complicate the definitions further, the body of the 
Guidebook states that capital assets, enterprise/component-level 
service contracts, interagency agreements, and strategically 
sourced acquisitions will follow Directive 102-01. 

These definitions do not provide clear instruction for determining 
if an acquisition should become an acquisition program, and in 
attempts to comply with the directive, components over classified 
programs. For example, the Federal Law Enforcement Training 
Center (FLETC) is automating many of its manual processes, such 
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as student registration, class scheduling, planning and forecasting, 
and student records. The estimated total life cycle cost of this 
automation is approximately $30 million. FLETC personnel 
contracted out all of the requirements for the program, including 
requirements analysis, development, and maintenance of an 
automated system that used commercial off-the-shelf (COTS) 
equipment and custom software applications. Because of the 
unclear instructions, instead of creating a simple procurement, 
FLETC created an acquisition program that may have 
unnecessarily increased program management administrative cost. 

We reviewed several acquisition programs that do not clearly fit 
into the Acquisition Lifecycle Framework process. Ten of the 17 
(59%) programs we reviewed, with an estimated life cycle cost of 
about $5.3 billion, were acquisitions that identified COTS 
equipment or existing contracts to fulfill the needs identified by the 
program office. Component personnel likely could have managed 
these as simple procurements rather than acquisition programs. 
For example, TSA classified renovation of an existing warehouse 
building as an acquisition program. It leased the 104,000-square- 
foot building in 2003 and renovated approximately 89,000 square 
feet for about $42 million over the initial 10-year leasing period. 
In 2008, TSA primarily relied on existing contracts to complete 
12,500 of the remaining 15,000 square feet of the warehouse 
building. According to TSA personnel, the renovation for the 
additional 12,500 square feet cost about $2.5 million, with 
construction completed in January 2010. For this small renovation 
project, TSA personnel could have used simple procurement rules 
but instead increased administrative costs by implementing the 
more complicated internal control structure prescribed in Directive 
102-01. 

Based on the definition of an acquisition program in the 
Guidebook, this renovation could possibly be an acquisition 
program. However, based on the processes and procedures laid out 
in Directive 102-01's Acquisition Lifecycle Framework and 
Acquisition Review Process, this renovation does not clearly meet 
the intentions of the existing guidance or present a high level of 
risk to warrant the increased costs of being managed as a program. 

Components should not create acquisition programs for acquiring 
products and services under a simple procurement action that are 
outside the intent and spirit of Directive 102-01. The department 
can reduce some of the conflicts at the component level by 
developing a decision matrix that the components can apply in the 
pre-planning phases of the purchasing process. 

DHS Oversight of Component Acquisition Programs 



Page 7 



nPRS Reporting Guidance 

The department developed inconsistent reporting requirements for 
components to follow when reporting an acquisition's progress in 
the department's standard reporting system. nPRS is an integrated 
system that provides visibility to the department to track 
components' level 1, 2, and 3 acquisition investments. It also has 
capabilities to store working and approved key acquisition 
documents, earned value management information, and risk 
identification. Component personnel are responsible for entering 
and updating information regarding their acquisition programs in 
nPRS. This information includes, but is not limited to, cost, 
budget, performance, and schedule data. 

For the 17 acquisition programs we reviewed, with an estimated 
life cycle cost of about $9.6 billion, we found that components 
were not completing and reporting all key information in nPRS. 
Component personnel input 16 of 17 programs reviewed (94%) 
into nPRS; however, despite detailed nPRS guidance, not all 
programs contained the required information. For example, only 7 
of 17 programs (41%) reported Acquisition Program Baseline 
required milestones, which establish the overall acquisition cost, 
schedule, and performance values. Only 13 (76%) programs 
reviewed contained required key documentation. Key documents 
include the mission needs statement, acquisition plan, operational 
requirements document, integrated logistics support plan, and the 
acquisition program baseline. 

Since nPRS became operational in 2008, the department has issued 
conflicting guidance and enforcement for reporting level 1, 2, and 
3 acquisition programs. According to APMD personnel, level 1 
and 2 acquisition programs are the only programs that require 
nPRS reporting, while reporting level 3 acquisition programs is 
optional. Despite APMD personnel's explanation of the nPRS 
reporting requirements, in November 2008 they required level 1, 2, 
and 3 acquisitions to follow the DHS periodic reporting process 
identified in the nPRS manual. Then in May 2009, the USM 
issued a memorandum requiring major acquisition programs, level 
1 and 2, to transition to nPRS by the end of the month. In July 
2009, the Office of the Chief Information Officer issued guidance 
that required components to report all programs to nPRS. In 
September 2009, the Director of APMD issued a memorandum 
designating nPRS as the department's system of record for 
acquisition management data and official reporting system for all 
level 1, 2, and 3 acquisition programs. In January 2010, the 
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APMD issued the final Directive 102-01, which required all level 
1, 2, and 3 acquisition programs to comply with the DHS periodic 
reporting process. This conflicting verbal and written guidance 
confused component personnel, who were not sure whether to 
report all acquisition programs or only level 1 and 2 programs. 
Figure 2 depicts the timeline of conflicting nPRS reporting 
guidance. 



Figure 2. nPRS Policy Timeline 
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In May 2010, the USM issued a list of major acquisition programs 
that identified 86 level 1 and 2 acquisition programs and elevated 
some level 3 acquisition programs for departmental oversight. 
According to APMD personnel, the department and components 
jointly create the major acquisition program and project list. The 
APMD obtains information from nPRS and requests updated 
information from the components regarding their current number 
of acquisition programs. Once APMD personnel receive the 
information, they create the final list and the USM signs and issues 
the new list. 

As of July 2010, we identified six acquisition programs listed on 
the USM letter, but components did not report them in nPRS. We 
also identified five level 1 and 2 acquisition programs reported in 
nPRS but not on the USM letter. When we questioned department 
personnel about the differences between the USM letter and nPRS, 
they stated that the differences were due to timing issues. 
However, we were not able to reconcile the differences to verify 
that they were timing related. Table 2 compares the list of 
acquisition programs in the May 2010 USM memo with the nPRS 
database as of July 2010. 
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Table 2. Acquisition Program Reporting System Inconsistencies 




nPRS Database -July 2010 



Consolidated Mail System Program 
Electronic Records Management System 
St. Elizabeth's 
National Security System Program 
Online Tracking Information System 
Federal Protective Services 



No Entry 
No Entry 
No Entry 
No Entry 
No Entry 
No Entry 



No Entry 
No Entry 
No Entry 
No Entry 
No Entry 



Critical Infrastructure 
Technology and Analysis 
CBP - Infrastructure 
FEMA - Infrastructure 
ICE - Infrastructure 
USSS - Infrastructure 



To identify the number of acquisition programs in the department, 
we requested a list of all programs from nPRS, but the department 
could provide only level 1 and 2 acquisition programs. In March 
2010, we requested that the components provide us with a list of 
all level 1, 2, and 3 acquisition programs so we could gain a 
complete inventory of acquisition programs throughout the 
department. Table 3 shows some inconsistencies between the 
department's totals and the components' totals. 

Table 3. Acquisition Program Inconsistencies 
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46 
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49 
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82 


nPRS datapull July 2010 


50 


32 


70 


152 


COMPONENTS 


48 


22 


152 


222 



See Appendix D for the detailed spreadsheet. 



We obtained the department's totals at five different times. Though 
we understand that there may be differences in timing due to the 
intervals, the department needs to make sure that components are 
consistently reporting all acquisition programs into the standard 
system. In July 2010, we obtained our last data from nPRS that 
showed progress regarding the number of level 3 acquisition 
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programs components entered in the system. However, nPRS still 
does not reflect half of the total number of level 3 programs 
components reported outside nPRS. 

The department does not always know what is in its acquisition 
portfolio because of the conflicting written and verbal guidance 
provided to the components. The department has not ensured that 
components report all level 1, 2, and 3 acquisition programs in 
nPRS, which hinders its ability to have complete visibility into 
components acquisition programs. By mandating use of nPRS for 
all acquisition programs, the department would have visibility into 
components' acquisition programs and could provide better 
oversight for its acquisition portfolio. 

Available Tools 

The department has not ensured or mandated that components use all 
available tools and supporting programs, including nPRS and the 
department's Strategic Sourcing Program Office (SSPO), to provide 
transparency and efficiency of component acquisition programs. As a 
result, some components have developed systems comparable to nPRS and 
may have awarded contracts without consideration of the SSPO. 

nPRS Tools 

The department, in conjunction with the APMD and the Office of 
the Chief Information Officer, developed and currently maintain 
nPRS. nPRS manages the department's level 1, 2, and 3 
acquisition programs by incorporating numerous tools for the 
department and components to provide oversight and visibility. 
Tools available within nPRS include the following: 

• Current and previous contract award data with earned value 
management 

• Previous, current, and future budget and funding 

• Cost, schedule, and performance status based on 
Acquisition Program Baseline parameters 

• Information technology program milestone schedule and 
cost variances 

• Acquisition Decision Memorandum forms that track action 
items issued by the Acquisition Review Board 

• Key documents approved by the department or component, 
such as the Mission Needs Statement, Acquisition Plan, and 
Acquisition Program Baseline 
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According to APMD personnel, nPRS allows components to create 
a copy of nPRS software and integrate it to meet the components' 
needs. The copy, which is called the nPRS Sandbox, allows the 
components to duplicate the department's copy of the nPRS 
software and to use the already developed nPRS as their oversight 
tool for draft documents, component approval process for 
documentation, earned value management, as well as cost and 
schedule status. The component's Sandbox copy of nPRS is not 
visible by the department or other components because nPRS 
restricts access to unauthorized users. As of July 2010, three 
components had requested use of the nPRS Sandbox feature: TSA, 
FEMA, and the DHS Chief Financial Office. 

Component personnel have developed, or they are in the process of 
developing, their own data- tracking systems because the 
department has not consistently mandated use of nPRS or its tools 
within the system. For example: 

• TSA hired and spent approximately $100,000 for a 
contractor in 2005 to develop the TSA Acquisition Program 
Status Report, which served as its data-tracking system. As 
of June 2010, TSA had merged its acquisition program 
portfolio, levels 1, 2, and 3, into the department's nPRS and 
will no longer report to the TSA Acquisition Program 
Status Report. As of August 2010, nPRS will be its official 
tracking system for acquisition programs. 

• Customs and Border Protection (CBP) personnel were in 
the process of developing a database to track acquisitions 
throughout the Acquisition Lifecycle Framework. We were 
not able to determine the cost of this tracking database. 
According to CBP personnel, the database was a verbal 
agreement between CBP personnel and the contractor for 
the development and tracking of the database. The 
statement of work did not contain any mention of the verbal 
agreement. 

• FEMA, CBP, ICE, and U.S. Secret Service use internally 
developed systems based on software programs such as 
Microsoft SharePoint. 

The department has not consistently mandated and ensured that 
components use nPRS for all level 1, 2, and 3 acquisition programs. 



DHS Oversight of Component Acquisition Programs 
Page 12 



Strategic Spurring Program Office 

The department has not ensured that the components use the SSPO 
when managing acquisition programs. Directive 102-01 and the 
Information Technology Integration and Management Directive, 
MD 0007.1, do not require components to consider the SSPO when 
planning for acquisition programs. The department created the 
SSPO, within the Office of the Chief Procurement Officer, to help 
components do the following: 

• Identify best prices available for a requirement 

• Engage in market research to identify the best available 
vendors and manufacturers 

• Minimize duplication of effort for market research 

• Provide department- wide contract vehicles 

Of the 17 component acquisition programs we reviewed, 10 (with 
an estimated life cycle cost of about $5.3 billion) were acquisition 
programs that component personnel awarded or plan to award 
contracts for the procurement and development of COTS software 
and equipment. Six of the 10 programs (with an estimated life cycle 
cost of about $5.1 billion) relied on a department- wide contract for 
some or all of their procurement needs, and components awarded or 
will award 3 programs (with an estimated life cycle cost of about 
$.19 billion) to vendors outside the department- wide strategically 
sourced contracts. The remaining program was in the analyze/select 
phase and the component had not determined which procurement 
mechanism to use. 

Components did not consider the SSPO when planning and 
awarding procurements. For example, FLETC personnel created 
an acquisition program to provide electronic training materials. 
FLETC used a Small Business Administration 8(a) contractor to 
procure some of its requirements, but it did not use a General 
Services Administration vendor to procure its COTS equipment. If 
FLETC had used a General Services Administration vendor to 
procure its COTS equipment, it might have saved resources. 
However, it can benefit from the future department- wide contract 
for its wireless communication requirements. 

The SSPO identified five future department- wide contracts for 
acquiring canines, dog supplies, dog food, veterinary care, and 
explosive training aids and storage. TSA established an 
acquisition program to use canines and handlers to deter and detect 
the introduction of explosives into the transportation system. 
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However, TSA is not required to consider using the SSPO 
contracts to purchase these canine requirements, which may 
increase procurement costs. 

Because the current guidance is silent regarding the use of the 
SSPO, the department may be incurring increased cost for 
component procurements. In addition, components may be 
conducting duplicative market research for procurements that the 
SSPO has performed. The department should make sure 
component personnel are at least considering use of the SSPO 
during the planning stages of their acquisition programs before 
awarding any contracts. 

Component Policies and Procedures 

The department has not taken steps to ensure that all components have 
developed prescribed policies and procedures for oversight of acquisition 
programs. Directive 102-01 states that components retain the authority to 
set internal acquisition processes and procedures, as long as they are 
consistent with the spirit and intent of the directive. However, not all 
components have created such policies and procedures, and the 
department has not taken steps to ensure the adequacy of the processes and 
procedures that components developed. 

We performed a department- wide review of component policies and 
procedures regarding acquisition management. As depicted in Table 4, 
four components have created and issued finalized policies, five have draft 
policies, and three were not able to provide any policies or procedures. 
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Table 4. Component Policies and Procedures 









Unable 








to 


component 


Finalized 


urait 


.rroviae 


Transportation Security Administration 








United States Coast Guard 


V 






National Protection and Programs 


V 






Directorate 








Domestic Nuclear Detection Office 


V 






Federal Law Enforcement Training Center 








Customs and Border Protection 








United States Secret Service 




/ 

V 




Federal Emergency Management Agency 








U.S. Citizenship and Immigration 
Services (USCIS) 








Immigration and Customs Enforcement 








Office of Health Affairs 








Science and Technology 









*FLETC has issued System Engineering Life Cycle policy, but not acquisition 
management policy. 

**USCIS has issued procurement policy, but not acquisition management policy. 



The department prematurely gave approval authority in Directive 102-01 
for level 3 acquisition programs without ensuring that components' 
policies and procedures were in place and operating effectively. For the 
six components in our file review — 

• Two (33%) have finalized policies. 

• Three (50%) have draft policies. 

• One (17%) does not have any policy. 

In addition, components are not always following prescribed department 
or component guidance. For example, FLETC requested funding for one 
of its level 3 acquisition programs through the Office of Management and 
Budget in 2006. According to component personnel, the department 
denied the request but intended for the component to execute a pilot 
program. If the pilot program succeeded, the program office would 
request additional funding from the department. The component went 
forward, created a pilot program, and is currently procuring equipment and 
foresees that the pilot program will be a success. If the department 
approves the pilot program and provides additional funding, the 
acquisition program will proceed without having to perform any 
formalized acquisition management. This would not comply with the 
requirements of Directive 102-01. 
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The department must ensure that components are in full compliance with 
departmental guidance. Because the department gave approval authority 
to the components for level 3 programs, it should implement a plan of 
action, with deadlines, for components to complete finalized acquisition 
management policies and procedures. 

Recommendations 

We recommend that the Chief Procurement Officer: 

Recommendation #1 : Develop a decision matrix tool that guides 
components on identifying when to apply life cycle management 
processes to acquisitions. 

Recommendation #2 : Direct components to report all acquisition 
programs (levels 1, 2, and 3) to nPRS. 

Recommendation #3 : Require all components to consider using 
the Strategic Sourcing Program Office, General Services 
Administration Schedule, and department-wide contracts in the 
planning phase of an acquisition program. 

Recommendation #4 : Implement a plan of action or completion 
deadline for department- wide finalization of acquisition 
management policies and procedures. 

Management Comments and OIG Analysis 

The Deputy Chief Procurement Officer (CPO) provided comments 
on a draft of this report. A copy of the comments in their entirety 
is included in Appendix B. The CPO concurred with the 
recommendations in the report. 

Management Comments to Recommendation #1 

The CPO concurred with the recommendation. During FY 201 1, 
APMD will develop a decision matrix tool to guide components on 
identifying when to apply life cycle management processes to 
acquisitions. 

OIG Analysis : The CPO's actions are responsive to the 
recommendation. The decision matrix tool will help component 
personnel determine when to follow simple procurement rules rather 
than creating acquisition programs that follow the acquisition 
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lifecycle framework. The recommendation is resolved, but will 
remain open until the CPO provides a copy of the decision matrix. 

Management Comments to Recommendation #2 

The CPO concurred with the recommendation. By April 30, 
APMD will issue guidance to components that will require 
inclusion of all level 1, 2, and 3 acquisition programs within the 
nPRS tracking tool. 

OIG Analysis : The CPO's actions are responsive to the 
recommendation. APMD's revised guidance will allow the 
department to provide better oversight of its acquisition portfolio 
and ensure complete visibility into components' acquisition 
programs. The recommendation is resolved, but will remain open 
until the CPO provides a copy of the guidance that requires level 1, 
2, and 3, acquisition programs report to nPRS. 

Management Comments to Recommendation #3 

The CPO concurred with the recommendation. APMD/Cost 
Analysis Division will revise the current Directive 102-01 
language to ensure that Federal Acquisition Regulation at 7.102(a) 
and the Homeland Security Acquisition Manual at 3007.102 
requirements regarding mandatory consideration of strategic 
sourcing, department-wide contracts, and other contract vehicles 
that increase acquisition process efficiencies and provide volume- 
related discounts are addressed. 

OIG Analysis : The CPO's actions are responsive to the 
recommendation. However, the recommendation is unresolved 
and remains open until the CPO provides a target completion date 
for the revision to Directive 102-01. An update to Directive 102- 
01 that requires mandatory consideration of strategic sourcing will 
help reduce potentially increased procurement cost and duplicative 
market research for procurements. 

Management Comments to Recommendation #4 

The CPO concurred with the recommendation. In a memorandum 
dated January 22, 2009, the DHS USM addressed the desire for 
each component to have a Component Acquisition Executive to 
lead a process and staff to provide acquisition and procurement 
oversight, policy, and guidance to ensure that statutory, regulatory, 
and higher-level policy requirements are fulfilled. APMD will 
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ensure that the guidance in that memorandum is fully executed, 
thereby addressing the Inspector General's recommendation. 

OIG Analysis : CPO's actions are nonresponsive, and the 
recommendation remains unresolved and open until the CPO 
provides a target completion date and a corrective plan of action 
that states what APMD will do to ensure that the department- wide 
policies and procedures are finalized and in place. 

Management 9 s Technical Comments on Report Content 

The CPO also provided technical comments and suggested 
revisions to sections of our report. As appropriate, we made 
changes throughout the report in response to these technical 
comments and suggested revisions. We did not make the 
following changes: 

• Background Section : The CPO noted that the description of the 
Component Acquisition Executive responsibilities was not 
consistent with the guidance in the Guidebook. 

OIG Analysis : We relied on Directive 102-01, signed January 
20, 2010, for the acquisition management roles identified in the 
report. If the Component Acquisition Executive roles are more 
consistent in the Acquisition Instruction/Guidebook dated 
November 7, 2008, the department needs to revise Directive 
102-01. 

• nPRS Reporting Guidance Section : The CPO did not agree with 
the conflicting guidance section of the report for level 1, 2, and 3 
acquisition programs. Directive 102-01 specifies that level 1, 2, 
and 3 acquisitions must comply with the DHS periodic reporting 
process. The nPRS manual identifies reporting requirements. 
The nPRS manual states that all major acquisition programs — 
levels 1, 2, and 3 for information technology (IT) — programs 
and levels 1 and 2 programs for non-IT programs — are required 
to report to nPRS. 

OIG Analysis : According to APMD personnel, level 1 and 2 
acquisition programs are the only programs that require nPRS 
reporting, while reporting for level 3 acquisition programs is 
optional. Directive 102-01 (interim and final) directs users to the 
nPRS manual for reporting requirements. The nPRS manual 
provided during the audit was version 07.20.2010. It states that 
nPRS is "an integrated decision support capability that manages 
the department's major acquisition level 1, 2, and 3 
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investments." The director of APMD issued a memorandum in 
September 2009 that as of October 1, 2009, nPRS is the 
department's system of record for acquisition management data 
and reporting for all acquisition programs (level 1, 2, and 3). 
CPO's implementation of recommendation #2 will resolve all 
conflicting guidance issues described in the report. 

• Component Policies and Procedures Section : CPO did not agree 
that USCIS has not issued final acquisition management policy. 

OIG Analysis : During the audit, USCIS personnel provided a 
copy of Management Directive No. 124-001, Acquiring Goods 
and Services, effective April 30, 2010. This management 
directive provides policy for procuring goods and services, 
entering receipt, acceptance, and payment information into the 
financial accounting system. Directive No. 124-001 does not 
contain policy for acquisition management. Procurement is a 
part of the overall acquisition management process. 

• Appendix D, Acquisition Program Comparison : CPO stated that 
the comparison chart contained an error regarding USCIS 's total 
of level 1 acquisition programs. USCIS has one level 1 program, 
not three as shown in the chart. 

OIG Analysis : The chart in appendix D is a comparison of the 
level 1, 2, and 3, acquisition program information obtained from 
the department and the components. The purpose of the chart is 
to show the inconsistencies between the department's totals and 
the components' totals regarding the number of level 1, 2, and 3 
acquisition programs. USCIS reported three level 1 acquisition 
programs. However, the department's nPRS and USM letters 
showed one level 1 program. 
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Appendix A 

Purpose, Scope, and Methodology 

This report provides the results of our work to determine whether 
DHS has established adequate management oversight and controls 
over components' acquisition programs. To achieve our objective, 
we reviewed federal regulations, as well as DHS and component- 
specific guidance, to determine the requirements for acquisition 
programs. 

We sampled acquisition program files from six DHS components. 
We used three criteria elements to select our judgmental sample of 
17 acquisition programs. We looked at the following: 

• Life cycle cost estimate of the programs 

• Number and level of programs at the components 

• IT or non-IT programs 

We also coordinated our selections with the Government 
Accountability Office team that performed a similar audit during 
the same timeframe. Our sample covered acquisition offices 
within the Customs and Border Patrol, Federal Law Enforcement 
Training Center, Immigration and Customs Enforcement, 
Transportation Security Administration, U.S. Coast Guard, and 
U.S. Secret Service. The Federal Emergency Management Agency 
was initially included in our sample; however, it was not able to 
provide its list of acquisition programs, policies, and procedures 
during the survey and fieldwork phases of the audit. Subsequent to 
a meeting with its senior management to share our tentative audit 
results, FEMA provided some draft acquisition program numbers 
and draft policies and procedures. See appendix C for the list of 
acquisition programs we reviewed. 

We conducted this performance audit between January and August 
2010 pursuant to the Inspector General Act of 1978, as amended, 
and according to generally accepted government auditing 
standards. Those standards require that we plan and perform the 
audit to obtain sufficient, appropriate evidence to provide a 
reasonable basis for our findings and conclusions based upon our 
audit objectives. We believe that the evidence obtained provides a 
reasonable basis for our findings and conclusions based upon our 
audit objectives. 
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1 1 ) On payc Li, wilhini Table d B ertltlcd "'COLnp^ticr.L Policies and Procedure^" CROnuls* 
tliat feiublu mjiJ itMitmro 2 wrltitf Ihtu U&CJS has moL issued thiaJ acqui^ii hin 
uuintigcmcni pn I icy. CPO nQk?s Ihwi 1 '5 5 n I H h a*, issued final ti^q art iiiana^mwiil 
r alu:y. Therefore, C\*Q rettinnwl* Ihm ihh tabic and its wcund footnote be revised ki 



AiH^ndis C: "Acq nihil hi n rrfierarn^ Re^ lcwitl" 

! } WaWn dw lahlc on pugg 19. CPO Hut ISA * ^cfeefilng Parroj^hip MgRln ' is 
not an IT program, CW) nscfmimcndt ihal (his ilcm be awdificd (he anvd canegwy 
of Thd-ITY' niihin lln* la« cdumi <j| Ibc lab 



11 Viittin ihc u**e c c aafc 20. C PO wic* tfiafl. Jnril Lcv^ } pr ^aic itefincd by 
APMD via fertbcoming DcTMrtn^m^^de gratam^ flit n^iiLtotaJ Mi 

Lei.^i ^datainclixfcdihmrin Vfrfcn^Hj. ^i*iio ihe List cdrarm U f *!i taht. enhded 
"tTKM^ONENT 1 <Ji AtS." **wte » m emir wtthir Thr T RCIS lufcd for I 
r»r?p™i- lK- USC IS *rt«J fr* r | pfwtjam^ i= nrt pnH™n_ wf OcW Ea Ihc 
previous column^ m this Libhr. CPU 1 ttic.iit-fc.nr rcqursl^ that Ac Isacokmn af DX5 aHt 
be corratol i*t jdum chat U^iCtS n^urleii «nly one Level 1 uuniiiiu jii |«t^ juu. 
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Appendix C 

Acquisition Programs Reviewed 



DHS Acquisition Programs Reviewed 


Component 


Program Name 


ITornon-IT 




TSA 


Screening Partnership Program 


non- IT 


USCG 


HC 103 J Fleet Introduction (6 aircraft) 


non- IT 


CBP 


Non- Intrusive Inspection Program 


IT 


ss 


Information Integration and Transformation 


IT 


LEVEL2 


ICE 


ATLAS 


IT 


TSA 


TTAC Infrastructure Modernization 


IT 


TSA 


National Explosives Detection Canine Team Program 


non- IT 


CBP 


Advanced Passenger Information System 


IT 




Level 3 




TSA 


HAZMAT Threat Assessment Program 


non- IT 


TSA 


Freedom Center (formerly Trans Security Ops Center) 


non- IT 


TSA 


Performance and Results Information System 


IT 


TSA 


Consolidated Screening Gateway 


IT 


TSA 


Internodal Security Training Exercise Program 


non- IT 


USCG 


Coast Guard Logistics Information System 


IT 


CBP 


Analytic Framework for Intelligence 


IT 


FLETC 


Student Administration & Scheduling System (SASS) 


IT 


FLETC 


TRAIN 21 


IT 
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Appendix D 

Acquisition Program Comparison 

















DEPARTMENT TOTALS 


















1 
1 


COMPONENT TOTALS 


| USM Letter Apr 23, 2009 


nPRS March 2010 




USM Letter May 26, 2010 


nPRS June 2010 




nPRS July 2010 


















LI 


L2 L3 


Total 




LI 


L2 L3 Total 




LI 


L2 


L3 Total 




LI 


L2 L3 


Total 




LI 


L2 


L3 Total 






LI 


L2 


L3 


Total 


A&O 





2 


2 


A&O 





2 


2 


A&O 





2 


2 


A&O 




2 


2 


A&O 




2 


1 


3 




A&O 








* 


CBP 


10 


6 


16 


CBP 


10 


4 


14 


CBP 


10 


6 


16 


CBP 


11 


6 


17 


CBP 


11 


5 


3 


19 




CBP 


10 


5 


4 


19 


DHS 


2 


2 


4 


DHS 


1 


2 


3 


DHS 


2 


5 


7 


DHS 


1 


2 


3 


DHS 


1 


2 


1 


4 




DHS 








* 


DNDO 


1 


1 


2 


DNDO 


1 





1 


DNDO 


1 





1 


DNDO 


1 




1 


DNDO 


1 




1 


2 




DNDO 


1 





10 


11 


FEMA 


2 


3 


5 


FEMA 


1 


1 


2 


FEMA 


1 


3 


4 


FEMA 


2 


3 


5 


FEMA 


2 


3 


5 


10 




FEMA 


1 


4 


3 


8 


FLETC 











FLETC 











FLETC 











FLETC 









FLETC 






1 


1 




FLETC 








3 


3 


I&A 











I&A 











I&A 


1 


1 


2 


I&A 









I&A 













I&A 











ICE 


1 


2 


3 


ICE 


4 


2 


6 


ICE 


2 


6 


8 


ICE 


3 


4 


7 


ICE 


4 


4 


2 


10 




ICE 


2 


3 


35 


40 


NPPD 


3 


2 


5 


NPPD 


3 


2 


5 


NPPD 


3 


3 


6 


NPPD 


3 


3 


6 


NPPD 


3 


3 


4 


10 




NPPD 


3 


1 


24 


28 


OHA 


1 





1 


OHA 


1 





1 


OHA 


1 





1 


OHA 


1 




1 


OHA 


1 




1 


2 




OHA 


1 








1 


S&T 





2 


2 


S&T 





2 


2 


S&T 


2 





2 


S&T 


2 




2 


S&T 


2 






2 




S&T 


2 





2 


4 


TSA 


6 





6 


TSA 







6 


TSA 


7 


5 


12 


TSA 


8 


5 


13 


TSA 


8 


5 


36 


49 




TSA 


6 


7 


36 


49 


USCG 


15 


3 


18 


USCG 


15 


3 


18 


USCG 


15 


5 


20 


USCG 


15 


5 


20 


USCG 


15 


5 


6 


26 




USCG 


18 





1 


19 


USCIS 


1 


2 


3 


uscfe 


1 


2 


3 


USCIS 


1 


3 


4 


USCIS 


1 


2 


3 


USCIS 


1 


2 


6 


9 




USCIS 


3 


2 


31 


36 


usss 











USSS 











USSS 





1 


1 


USSS 


1 


1 


2 


USSS 


1 


1 


3 


5 




USSS 


1 





3 


4 


Totals 


42 


25 


67 




43 


20 


63 




46 


40 







49 


33 


82 




50 


32 


70 


152 






48 


22 152 


222 



*These three components were not included in our department-wide data call. They are shown in the chart for comparative purposes only. 
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Appendix E 

Acquisition Lifecycle Framework (Directive 102-01) 



Acquisition Lifecycle Framework (Per DHS Management Directive 102-01 and Acquisition Instruction/Guidebook 102-01-001) 




* The Component may bypass the P-MNS and begin by preparing a MNS. 

** In the absence of the JRC, the MNS will be submitted by the component to the Director of APMD and the Assistant Director for Policy (through the Office of Strategic Policy) for endorsement. 
***Level 3 acquisition programs activities are notated in | with similar shade of lines. All activities in the flowchart are completed for Level 1 & 2 programs, except those annotated by ► . 


ADE — Acquisition Decision Event 
ADM - Acquisition Decision Memorandum 
AOA - Alternative of Analysis 
AP - Acquisition Plan 

APMD - Acquisition Program Management Division 
ARB - Acquisition Review Board 
ART -Acquisition Review Team 


CAE - Component Acquisition Executive 
CH - Component Head 
CDP- Capabilities Development Plan 
CONOPS - Concept of Operations 
ILSP - Integrated Logistics Support Plan 
JRC — Joint Requirements Council 
LCCE - Life Cycle Cost Estimate 


MNS - Mission Needs Statement 
ORD - Operational Requirements Document 
P-MNS - Preliminary Mission Needs Statement 
PM - Program Management 

SELC - Systems Engineering Life Cycle Tailoring Plan 
TEMP - Test Evaluation Master Plan 
USM - Undersecretary for Management 
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Major Contributions to this Report 

Linda Howard, Director 
LaParacina Williams, Audit Manager 
David Porter, Auditor-in-Charge 
Elizabeth Garcia, Auditor 
Kevin King, Auditor 
Andre Marseille, Program Analyst 
Gwendolyn Priestman, Program Analyst 
Marisa Coccaro, Referencer 
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Appendix G 

Report Distribution 

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff 

General Counsel 

Executive Secretariat 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

Office of Management and Budget 

Chief, Homeland Security Branch 
DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as 
appropriate 
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ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4100, 
fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 



OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 
misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 
Attention: Office of Investigations - Hotline, 
245 Murray Drive, SW, Building 410, 
Washington, DC 20528. 



The OIG seeks to protect the identity of each writer and caller. 



